Learn Cloud NetAzure networking, beginner to advanced0 XP0/80
Beginner · Review · 15 of 15

Review: peer two VNets and add an NSG

Your tasks
  • Connect the vnet-shop and vnet-pay peering on both sides
  • Create nsg-api and attach it to subnet-api
  • Get vm-shop reaching vm-pay on 443
Default rule
A rule Azure puts in every NSG. You can't delete it.

A new team built vnet-shop (10.30.0.0/16) and vnet-pay (10.40.0.0/16). vm-shop needs the API on vm-pay (10.40.1.4) at port 443, and security wants an NSG named nsg-api on vm-pay's subnet, subnet-api, before anything goes live. Someone started the peering from vnet-shop and stopped there. No steps this time, just what you've learned.

Sources on Microsoft Learn (3)
Create, change, or delete a virtual network peeringNetwork security groups overviewVirtual network service tags
0/3 changes
Network map
?
  • Resource group, the outer dashed frame
  • Virtual network, with its address space top right
  • Subnet, with range and usable IPs (5 reserved)
  • Network security group. A small shield on a VM's NIC means the NIC has one too
  • Route table on the subnet
  • NICVM Appliance Private endpoint
  • Peering Connected Initiated or access off
  • Goal working Goal broken, X marks where it stops
  • Private DNS zone, dotted lines go to linked VNets
  • Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.
Resource grouprg-labvnet-shop: tap to inspectVirtual networkvnet-shop10.30.0.0/16subnet-web: tap to inspectsubnet-web10.30.1.0/24 · 251 usablevm-shop 10.30.1.4: tap to inspectNICvm-shop10.30.1.4vnet-pay: tap to inspectVirtual networkvnet-pay10.40.0.0/16subnet-api: tap to inspectsubnet-api10.40.1.0/24 · 251 usablevm-pay 10.40.1.4: tap to inspectNICvm-pay10.40.1.4Initiated from shop: tap to inspectInitiated:443 ✗
  • vm-shop → vm-pay:443should work: dropped by routing
Goals 0/4
Cloud Shell · bashVMsrg-lab · eastus2
cloudshell:~$